Description of Sentinel Initiative and protections for privacy (in compliance with law and to build public trust)

1. The FDA’s Sentinel Initiative:
Beyond Safety Surveillance
Deven McGraw, JD, MPH, LLM
Partner
Manatt, Phelps & Phillips, LLP
May 30, 2014

2. FDAAA 2007
 HHS required to develop methods to access disparate
sources of electronic health information in order to monitor
the safety of medical products approved by the FDA.
 Law set a goal of access to data from 25 million patients
by July 1, 2010 and 100 million patients by July 1, 2012.
 Law also required FDA to work closely with partners from
public, industry and academic entities.

3. Mini Sentinel Pilot
 21 collaborating entities, including America’s Health
Insurance Plans, Cigna Healthcare, Duke University School
of Medicine, several Kaiser Permanente sites, and Outcome
Sciences, Inc.
 Brookings Institution served in the role as convenor,
hosting a number of open public meetings to help inform
the work of establishing the pilot and laying the foundation
for the Sentinel Initiative.
 Harvard Pilgrim Healthcare served as the Operations
Center.
 Privacy panel: privacy advocate, industry attorney,

4. Mini Sentinel/Sentinel Data
Architecture
 Distributed Data Model: Data Partners maintain physical
and operational control over the original source data and
data are transformed into the Mini-Sentinel Common Data
Model (MSCDM) format
 Operations Center sends standardized queries to Data Partners.
 Data Partners execute queries against data in the MSCDM format
and share summary results with Operations Center.
 Data Partners may be asked to provide non-summary, patient-
level information as follow-up, but will strip out direct patient
identifiers before disclosure to Operations Center

5. Legal Analysis
 Focused on potential application of HIPAA & the Common
Rule.
 Acknowledged that other medical privacy laws might
also apply (for example, Part 2 governing substance
abuse treatment data from federally assisted substance
abuse programs and state laws).
 Data Partners would need to determine whether those laws
applied to their use and disclosure of health information for
Sentinel purposes.

6. HIPAA Legal Analysis
 Sentinel determined to be public health use of health
information under HIPAA.
 Queries to Sentinel come from the FDA pursuant to its authority
under FDAAA.
 Harvard Pilgrim and Data Partners are acting under a grant of
authority from FDA; consequently, their access to health
information is also covered by the HIPAA Privacy Rule.
 Although care was taken to limit FDA and Harvard Pilgrim’s
access to identifiable data, HIPAA would have permitted such
access under the public health provisions
But possible application of HIPAA minimum necessary
provisions…

7. Common Rule
 OHRP determined that activities of Sentinel are not
“research” and therefore the Common Rule did not apply.
 Letter provided to FDA and Harvard Pilgrim.

8. Policies Address FIPPs
 Distributed data model: drug safety questions are brought to the
data
 All direct identifiers are removed from information provided to the
Operations Center or the FDA
 Any identifiable information received by Data Partners to confirm
drug safety signals may be used only for Mini-Sentinel purposes
 Operations Center may use information it receives only for Mini-
Sentinel purposes
 Operations Center manages security in accordance with the HIPAA
Security Rule and the Federal Information Security Management Act
 OHRP determined that activities of Sentinel are not

9. Use of Sentinel System for
Research Data infrastructure already exists – committed data
partners, experience with MSCDM, running queries
behind their firewalls, and providing aggregate response
to Operations Center.
 Could this infrastructure be deployed for research uses?
 Big difference: could no longer rely on HIPAA’s public
health provisions to govern information use and
disclosure.

10. How it Could Work
 Data Partners would conduct research behind their
firewalls
 Necessary steps:
 Determine whether or not to participate in a particular research
query.
 Obtain IRB approval of research.
 Consent patients or obtain IRB waiver.
 Collect and/or analyze data in common data model (may need
tweaks to MSCDM to accommodate research queries).
 Provide summary aggregate results to Operations Center (likely
de-identified; execute data use agreement in case of limited data
sets).

11. Issues to Consider
 Retaining publicly available research data set to test
findings
 Do data partners have sufficient resources to take on
conduct of research?
 Will this make the research process faster or slow it
down?

12. Resources
 White paper on legal basis for Sentinel:
http://mini-sentinel.org/work_products/About_Us/HIPAA_and_Co
 White paper exploring potential use of Sentinel
infrastructure for clinical trials: http://www.mini-
sentinel.org/methods/methods_development/details.as
px?ID=1049

13. Questions?
Deven McGraw
(202) 585-6552
dmcgraw@manatt.com